The vulnerability resides in MyBB’s Admin CP UTF‑8 Conversion module, where a GET request can trigger raw ALTER TABLE operations, column rewrites, and fulltext index rebuilds on the database table specified by the request. The module fails to validate the request, allowing a same‑site attacker with an authenticated admin session to change table encoding, effectively disabling or corrupting forum functionality. The flaw is classified as a CSRF weakness (CWE‑352) that can lead to data corruption and denial of service without impacting confidentiality.

All installations of MyBB prior to version 1.8.40 are affected. The issue is present in the admin modules/system_health.php “do=all” control flow used by the UTF‑8 Conversion tool. Administrators using older releases (e.g., 1.8.39 and earlier) should verify their install version and upgrade accordingly.

The recorded CVSS score of 4.6 indicates a medium severity flaw. Because the attack requires the attacker to pose as an authenticated administrator or to forge a same‑site request, exploitation probability is moderate but not trivial; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw via an innocuous URL accessed by an admin user’s browser. An unpatched system therefore faces the risk of service disruption and potential data loss until the fix in 1.8.40 is applied.